The cross-zip package contains a critical directory traversal vulnerability that could allow unauthorized attackers to read or write files outside of the intended directory structure.

This is a directory traversal vulnerability caused by improper input validation within the zipSync and unzipSync functions. An attacker can leverage this flaw by providing malicious path arguments, such as __dirname, to influence file operations performed by the package.

With a CVSS score of 7.5, this vulnerability represents a high risk to organizational security. Successful exploitation could lead to unauthorized file system access, potentially exposing sensitive configuration files, source code, or internal data, which may result in full system compromise or significant data breaches.

Immediate Action: Since no specific patch is currently identified, developers should audit their codebase for usage of the cross-zip package and consider migrating to a more secure alternative or implementing strict input sanitization for all path-related arguments.

Proactive Monitoring: Security teams should monitor application logs for suspicious directory traversal patterns, such as sequences containing double dots or references to system environment variables in file operation parameters.

Compensating Controls: Deploying a Web Application Firewall or runtime application self-protection tool may help block requests containing malicious directory traversal payloads before they reach the vulnerable functions.

Public Exploit Available: No

Given the lack of a verified patch, the risk posed by this directory traversal vulnerability is elevated. Organizations currently utilizing the cross-zip package should prioritize a transition to a secure library or implement robust input validation to prevent arbitrary file system access. Continuous monitoring of application behavior is essential until a permanent fix is available.